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^5 (57) Abstract: To address the need for an apparatus and method for handoff from a cellular wireless network to a non-cellular 
O wireless network (WLAN, e.g.), the present application describes an access gateway (214) and a dual mode mobile station (20 1) that 

enable such handoffs. Dual mode MSs can determine when a handoff to a non-cellular network is preferred and- request a handin 
^ (302) from the non-cellular network. The access gateway jnavides infomiadon to the MS (304) so that it can initiate a handoff 

through the serving cellular network. Triggering handoffs in this manner, allows cellular networks to handle handoffs to non-cellular 

networks in much the same way they handle inter-MSC handoffs today, i.e., source initiated. 
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METHOD AND APPARATUS FOR A SOURCE-INITIATED HANDOFF 
FROM A SOURCE CELLULAR WIRELESS NETWORK TO A TARGET 
NON-CELLULAR WIRELESS NETWORK 

5 

Cross-Reference To Related Application 

This application is related to a co-pending application entitled 
"METHOD AND APPARATUS FOR A TARGET-INITIATED HANDOFF 
10 FROM A SOURCE'CELLULAR WIRELESS NETWORK TO A TARGET 
NON-CELLULAR WIRELESS NETWORK", filed on even date herewith, 
and assigned to the assignee of the instant application. 



15 Field of the Invention 

The present invention relates generally to wireless 
communication systems and, in particular, to handoff from a source 
cellular wireless network to a target non-cellular wireless network. 

20 

Background of the Invention 

With the growing popularity of non-cellular wireless networks, 
25 such as wireless local area networks (WLANs), a demand for integration 
with overlaid or adjacent cellular networks has arisen In the marketplace. 
A solution for the integration of WLAN and cellular networks must 
include the ability to perfonn seamless handovers at least for voice 
services. Cun-ent cellular systems (e.g., GSM and CDMA) allow for 
30 such mobility between cell sites, but technology does not cun-ently exist 
to allow calls to be maintained across a cellular-to-WLAN border. 
Without this capability, a voice call would be dropped at the border of 



SCXXID: <WO^__20(M06876BA2,I > 



wo 2004/068768 



PCT/US2004/001289 



the two systems, or in an overlay situation, tiie call may continue but not 
under the control of the optimal or preferred system for that location. 
Therefore, a need exists for an apparatus and method for handoff from 
a cellular wireless network to a non-cellular wireless network. 
5 An overview of some handoff prior art will support the novelty of 

the invention described below. Handoffs across different wireless 
technologies have been accomplished before, for example, between 
CDMA and analog cellular. CDMA to analog handoff based on DAHO 
(Database Assisted Handoff) is a specific example. DAHO initiates a 

10 handoff from CDMA to analog based on the existence of pilot signals 
and location information stored In the source cellular system. However, 
this is not a viable solution for a CDMA-WLAN system because the 
number of WLAN APs are much larger than analog base stations, thus 
requiring very large databases to be stored in each CDMA base site. 

15 Consequently, this approach would be cumbersome and complex. 

Similar to CDMA-analog handoffis, UMTS-GSM handoffs are 
known. These handoffs are enabled by incorporating changes in the 
GSM and UMTS base sites to recognize each other's cell sites. This is 
done by modifying the existing list of neighboring cells to include cells of 

20 the other technology. Specific changes to handover signaling between 
the MS and the BS is also required to enable the handover. The 
invention described below does not involve any changes to the neighbor 
lists or introduce any new handover signaling between the MS and the 
cellular BS. 

25 Inter-MSC (mobile switching center) handoffs are defined in 

CDMA IS-95 B and GSM systems to provide handoffs between two 
base sites that are controlled by distinct MSCs. The Inter-MSC handoff 
procedures as defined in all cellular networks are initiated by the source 
MSC (the MSC cun-ently sen/ing the serving base site). The cun-ent IS- 

30 41 and MAP procedures (the interfaces governing the handoff 
procedure In CDMA and GSM respectively) only provide for source 
initiated handoffs. This can be seen, for example, in FIG. 1. FIG. 1 
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illustrates the inter-MSC handoff procedure for IS-95 systems based on 
the IS-41 specifications. (MAP procedures for GSM are similar.) 

The l<nown handoff procedure begins with the mobile station 
(iVIS) generating a CDMA Pilot Strength Measurement Message 
5 (PSMM) 1. The PSMM message contains the PN offsets and signal 
strengths (Ec/lo) of pilots in the MS's candidate and active set. The base 
site (BS) determines that the PN offset sent in the PSMM does not 
correspond to a cell under Its control. The BS generates a Handoff 
Required message 2 containing the Cell Identifier List (with Cell ID, and 
10 optionally more infomiation like MSC ID, LAC, etc). The source MSC 
then Identifies the target BS and the associated MSC. It sets up a 
terrestrial circuit to the target MSC, and sends an IS41_FACDIR2 
message 3. The message contains the inter-MSC circuit ID, target cell 
ID, and other handoff-related parameters like channel condition, etc. 
15 The target MSC then initiates a Handoff Request 4 to the appnapriate 
target BS. The message contains parameters that are mostly obtained 
(directly transfen-ed) from the FACDIR2 message. 

A Handoff Request A ck 5 is sent by the target BS to the MSC 
after radio resources and ten-estrial circuits are allocated, and an 
20 IS_41_facdir2 6 is sent to the source MSC containing the parameters 
obtained from the Handoff Request Ack message. The Handoff 
Command 7 is then sent to the source BS to begin the handoff 
procedure, and the information in this message is used to generate an 
IS95_Extended Handoff Direction Message 8, containing the new 
25 frequency channel and frame offset. The IS95_Handoff Direction 
Message instructs the MS to switchover to the target cell/BS and start 
sending preamble frames on the reverse channel. The MS acks this 
message by sending an IS95_Extended Handoff Direction Ack Message 
9 to the source BS. The source BS then sends a Handoff Commenced 
30 message 1 0 to the source MSC Indicating that the handoff is progress. 

When ready, the MS sends an IS_95 Handoff Completion 
message 11 to the target BS. The target BS then sends a Handoff 
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Complete message 12 to the target MSG, and the target MSG informs 
the source MSG of the successful handover with an MSONCH message 
13. Finally, a Glear Gommand message 14 and a Clear Complete 
message 15 are exchanged in order to release resources between the 
5 source BS and the source MSG. 

Two aspects of this prior art handoff messaging are particularly 
pertinent. First, it is the MS that Identifies the handoff target to the 
source BS and MSG by providing the PN offset of the target. Second, it 
is the source MSG that initiates the handoff messaging (see FIG. 1, 
10 message 3) by translating the PN offset to a target BS/MSC. However, if 
the target system were a WLAN system, the handoff target would be a 
WLAN access point (AP), and presently there is no messaging to enable 
either the MS or the source MSG to identify this target WLAN AP. 

15 

Brief Description of the Drawings 

FIG. 1 Is a message flow diagram of prior art messaging 
exchanged by system components to affect a handoff. 

20 

FIG. 2a is a block diagram depiction of a communication system 
in accordance with an embodiment of the present invention. 

FIG. 2b is a block diagram depiction of communication system 
25 components in accordance with an embodiment of the present 
invention. 

FIG. 3 is a messaging flow diagram of messaging and information 
exchanged by system components to affect a handoff in accordance 
30 with an embodiment of the present invention. 
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Detailed Description of Embodiments 

To address the need for an apparatus and method forhandoff 
from a cellular wireless network to a non-cellular wireless network 
: (WLAN, e.g.), the present application describes an access gateway and 
a dual mode mobile station that enable such handoffs. Dual mode MSs 
can determine when a handoff to a non-cellular network Is preferred and 
request a handin from the non-cellular network. The access gateway 
provides information to the MS so that it can initiate a handoff through 
the sen/ing cellular network. Triggering handoffs in this manner, allows 
cellular networks to handle handoffs to non-cellular networks in much 
the same way they handle inter-MSC handoffs today, i.e., source 
initiated. 

The disclosed embodiments can be more fully understood with 
reference to FIGs. 2a, 2b. and 3. FIG. 2a Is a block diagram depiction 
of communication system 200 in accordance with an embodiment of the 
present invention. Communication system 200 comprises a known 
wireless local area network (WLAN), a known cellular network, and 
components to interface them together, the combination suitably 
modified to Implement the present Invention. The WLAN is a known 
wireless infrastructure such as that confomiing to the IEEE 802.11 
standard. The cellular network is a well-known Code Division Multiple 
Access (CDMA) network, based on the Telecommunications Industry 
Association / Electronic Industries Association (TIA/EIA) standard IS-95. 
(The TIA/EIA can be contacted at 2001 Pennsylvania Ave. NW, 
Washington, D.C. 20006). In various alternative embodiments.' 
communication system 200 may utilize other cellular communication 
protocols such as, but not limited to, GSM. UMTS, IS-2000. and "IDEN." 

The cellular network of communication system 200 includes 
known radio access network (RAN) entities, such as base site (BS) 250 
(comprising a base site controller and one or more base transceiver 
stations), mobile switching center (MSC) 251 (which interfaces with 
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PSTN 205), and home location register (HLR) 252. Communication 
system 200 further includes WLAN access point (AP) 210. internet 
protocol (IP) network 21 1. circuit gateway 212, private branch exchange 
(PBX) 213, and cellular access gateway (CAG) 214. Both the WLAN 
5 and cellular network of system 200 support voice services. The WLAN 
supports voice over a pico-cellular environment, while the cellular 
network supports voice over the macro-cellular environment. As 
integrated into system 200, these networks further support voice- 
session mobility from the cellular network to the WLAN. 
10 Communication system 200 also includes mobile stations (MSs), 

such as MS 201. MS 201 is a dual-mode phone capable of 
communicating with both the cellular networi< (e.g., BS 250) and the 
WLAN (e.g.. AP 210). FIG. 2b depicts MS 201 Is greater detail. MS 201 
comprises well-known entities such as processor 204, dual-mode 
15 transmitter 202. and dual-mode receiver 203. Transmitters, receivers, 
and processors as used in MSs are all well known in the art. This 
common set of MS components is adapted using known 
telecommunications d esign a nd d evelopment techniques to Implement 
the wireless unit aspect of the present invention. Processors typically 
20 comprise components such as microprocessors, digital signal 
processors, memory, and/or logic circuitry designed to implement 
algorithms that have been expressed as computer instructions and/or in 
circuitry. Given an algorithm or a logic flow, those skilled in the art are 
aware of the many design and development techniques available to 
25 implement a processor that performs the given logic. 

FIG. 2b also depicts CAG 214 in greater detail. CAG 214 
comprises a known network interface 215 and cellular intenA/orking 
device 216. Networi< interi^ace 215 provides an access gateway interface 
to IP network 211, while cellular intenworicing device 216 performs 
30 cellular mobility interworking (e.g., intenvoricing for registration, 
authentication, and handoff) by interfacing with MSG 251, HLR 252, 
PBX 213, and circuit gateway 212. Cellular IntenA/orking device 216 also 
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performs PSTN interworking by interfacing with PSTN 205 using landline 
signaling protocols sucli as ISDN User Part (ISUP) and/or Multi 
Frequency R1 (MFR1). Generally, cellular and PSTN intenA/orkIng 
components are known in the art. These components in addition to 
network interface components are combined and adapted using known 
telecommunications design and d eveiopment techniques to implement 
the access gateway aspect of the present invention. Given a protocol or 
a message flow, those skilled in the art are aware of the many design 
and development techniques available to implement a networking 
platform that performs the specified function. 

Furthermore, those skilled in the art will recognize that FIGs. 2a 
and 2b do not depict all of the network equipment and devices 
necessary for system 200 to operate fully but only those system blocks 
and logical entities particularly relevant to the description of 
embodiments of the present invention. Those skilled in the art are aware 
of the many ways the necessary devices and entities can be 
implemented and/or purchased from wireless networking companies 
and wireless communications companies such as "MOTOROLA." 

High-level . operation of a first embodiment of the present 
invention occurs substantially as follows. In the first embodiment, MS 
201 's dual mode functionality allows it to support voice services over the 
cellular network and the WLAN. Thus, MS 201 supports a standard 
cellular voice call model such as one specified by the GSM. CDMA, or 
"IDEN" technologies, for example. For the WLAN domain, MS 201 
supports a voice over IP (VoIP) protocol, such as H.323, Session 
Initiation Protocol (SIP), or the Skinny Protocol of "CISCO." The VoIP 
protocols are used between MS 201 and circuit gateway 212. Circuit 
gateway 212, when connected to PBX 213, provides the interworking 
necessary for the desired PBX feature transparency to MS 201 . Also, for 
signaling with WLAN AP 210. MS 201 supports IEEE 802.1 1 signaling in 
the first embodiment, but signaling types such, as Bluetooth or HiperLAN 
2 may additionally or alternatively be supported in other embodiments. 
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Lastly, the dual mode capability of MS 201 allows it to measure the 
signal strength of the WLAN AP(s), such as AP 210, as well as the 
cellular BTS(s), such as those of BS 250. 

Generally, in the first embodiment, CAG 214 interworks the voice 

5 call model and mobility management within the WLAN domain with the 
voice call model and mobility schemes of the standard macro-cellular 
domain. It provides the required intenA/orking between the WLAN and 
cellular domain in the areas of cellular registration, authentication, and 
cross-technology handovers. In addition, it also interworks the cellular 

10 network with the existing voice Infrastructure (i.e., PBX 213 and circuit 
gateway 212) in the WLAN domain. 

In the first embodiment, cellular Interworking device 216 provides 
the appearance to a GSM / "IDEM" (MAP) or a CDMA (IS-41) cellular 
network that the WLAN domain is another standard cellular network. 

15 Cellular interworking device 216 enforces message discrimination by 
sending/receiving MAP/IS-41 messaging to/from an MSC/HLR. Cellular 
interworking device 216 effectively emulates either an MSC or a VLR 
role to the far-end macro-cellular domain. 

In the first embodiment, cellular interworking device 216 also 

20 keeps subscriber profile, supports authentication, supports registration, 
etc. At a minimum, cellular Interworking device 216 emulates a portion 
of the cellular VLR. It provides higher-layer mpbility support to allow 
CAG 214 to act like a standard MSC to the macro-cellular MSC/HLR 
domain. 

25 In addition, in the first embodiment, cellular interworking device 

216 provides service logic similar to call processing, but not a complete 
set. The distinction typically is between service/feature "control" and 
service/feature "execution." There are only a few scenarios (e.g. handoff 
from cellular to WLAN) where cellular inteoA^orking device 216 provides 

30 full call processing, allowing the connection to be made (I.e., control) 
and setting up the bearer connection through CAG 214 (i.e., basic 
execution). Since CAG 214 is only involved in inter-domain session 
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establishment and handoffs, these scenarios require functionality to 
maintain the basic state of the subscriber's session. In most other 
scenarios, like a PSTN to WLAN session establishment, PBX 213. 
provides all call processing. 
5 In the first embodiment, the general role of PBX 213 is to 

temninate circuit voice calls and provide call processing with access to 
voice features as if MS 201 were a typical wired telephone in the 
enterprise domain. In addition, the general purpose of circuit gateway 
212 is to interwork the voice call models in the WLAN-IP domain and the 
10 typical circuit (i.e., PBX) domain. This requires both bearer and control 
intenA/orking. The voice bearer a nd s ignaling from dual mode MS 201 
and WLAN APs connect over IP and may use IP telephony call model 
conventions. Since the IP telephony conventions do not work with the 
typical wired PBX, circuit gateway 212 provides this important 
15 interwprkingto PBX213. 

Messaging-focused operation of the first embodiment of the 
present invention occurs substantially as follows. FIG. 3 is a messaging 
flow diagram 300 of messaging and information exchanged by system 
components to affect a handoff from a cellular wireless network to a 
20 non-cellular wireless network (e.g., a WLAN) in accordance with the first 
embodiment of the present Invention. Already involved in a call, MS 201 
receives call Infomiation (301) via serving BS 250 and associated (i.e., 
sen/ing) MSG 251 . This call information refers to real-time call content 
such as voice or video-telephony. 
25 As MS 201 moves within the coverage area of WLAN AP 210, 

MS 201 performs signal strength measurements and establishes contact 
with AP 210. Establishing contact typically involves obtaining an IP 
address for itself (MS 201) and for an access gateway (CAG 214, in the 
first embodiment). At some point, MS 201 detenmines that a handoff 
30 from serving BS 250 to AP 210 is prefen-ed. MS 201 may determine this 
based on criteria such as the relative signal strength of BS 250 and AP 
210, the relative cost of wireless service, and/or user indications of 
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preference. For example, the user may set an MS option to switch to 
WLAN service whenever signal conditions allow or whenever the WLAN 
service is determine to be cheaper. 

Having detennined that a handoff is preferred, processor 204 
5 sends a handin request (302) to CAG 214. The request is sent to CAG 
214 via transmitter 202, WLAN AP 210, and IP network 211. Thus, the 
handin request is sent using an IP packet addressed to CAG 214. The 
handin request contains an indication of from which cellular wireless 
network MS 201 is attempting to handoff, i.e., which MSG is serving MS 
10 201. The indication takes the form of a serving cell identifier which CAG 
214 can use to determine the corresponding serving MSG. In the first 
embodiment, this serving cell identifier is the PN offset of MS 201 's 
serving cell within BS 250. while in an alternative GSM embodiment, the 
serving cell identifier may be the Base Transceiver Station Identity Code 
15 (BSIC) of MS 201 's sen/ing cell. 

Cellular interworking device 216 of CAG 214 receives the IP- 
packetized handin request from MS 201 via network Interface 215. In 
response to MS 201 's handin request, cellular interworking device 216 
sends a handin request acknowledgment (304) to MS 201 . This handin 
20 request acknowledgment is sent via network Interface 215, IP network 
211, and WLAN AP 210. Importantly, the acknowledgment contains a 
handoff-target identifier, such as a cell identifier. In the first embodiment, 
this handoff-target identifier is a value that is predefined to trigger an 
automatic handoff determination by the cellular wireless network from 
25 which the MS is attempting to handoff. In other words, it could be either 
a "spoor value or a valid cell Identifier that will be recognized (i.e., the 
cellular network has been preprogrammed to recognize) as a trigger for 
handoff to this non-cellular network. In an alternative embodiment, the 
handoff-target identifier may simply be a valid cell identifier for the non- 
30 cellular network that will not be specially recognized. 

Processor 204 of MS 201 receives the handin request 
acknowledgment via WLAN AP 210 and receiver 203. After receiving 
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the acknowledgment, processor 204 sends a signal strength message 
(306) via transmitter 202 to serving BS 250. This signal strength 
message connprises values intended to trigger a handoff determination. 
Specifically, In the first embodiment, the signal strength message is a 
5 CDMA PSMM containing the handoff-target identifier from the handin 
request acknowledgment. Thus, the PSMM is sent in order to trigger a 
handoff to the WLAN. as identified by the handoff-target Identifier. 
Alternatively, the PSMM could contain a regular cell identifier for the 
WLAN but with an artificial signal strength value associated with the cell 
10 Identifier, which is intended to trigger a handoff to the W1_AN identified 
by the cell Identifier. In an alternative GSM embodiment, the signal 
strength message could instead be either a MEAS_RES (Measurement 
Result) message or a MEAS_REP (Measurement Report) message. 

Thus, it is the handoff source (i.e., the serving cellular network) 
15 that initiates the handoff of MS 201 from the cellular network to the 
WLAN. However, for this to occur, handoff-target information is sent to 
the MS by the target network (i.e., the WLAN). This information is then 
used by the MS to trigger the handoff procedures. Note, that the cellular 
network needs to be able to recognize the handoff-target identifier that it 
20 receives In the PSMM, so some sort of agreement that addresses this 
between the network operators of the WLAN and cellular network is 
envisioned. 

BS 250 receives the PSMM and detennlnes that a handoff for MS 
201 should be initiated. BS 250 sends a handoff required message 

25 (308) to MSG 251, and sen/ing MSC251 then sets up the necessary 
circuits and sends a FACDIR2 message. CAG 2 14 receives the MAP 
FACDIR2 message (310) from serving MSG 251 and sends a MAP 
facdir2 message (312) back in response. 

Serving MSG 251 then sends an initiate handoff message (314) 

30 to serving BS 250. In the first embodiment, this initiate handoff message 
would be a Clear Command signaling sen/ing BS 250 to clear Its 
wireless resources supporting MS 201. Release channel messaging 
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particular to the cellular network (e.g., IS-95 or GSM messaging) is then 
exchanged (316) between MS 201 and BS 250. For example, processor 
204 of MS 201 receives a handoff release indication from BS 250 via 
receiver 203. In the first embodiment, this indication would be a CDMA 
5 Handoff Direction Message, while In an alternative GSM embodiment 
this indication may be a HND_CMD (handoff command) message. 

After completing channel release messaging, processor 204 of 
MS 201 sends a handoff complete indication (318) to GAG 214 via 
transmitter 202, WLAN AP 210, and IP network 211. Thus, the handoff 

10 complete indication is sent using an IP packet addressed to GAG 214. 
Cellular interworking device 216 of GAG 214 receives the IP-packetized 
handoff complete Indication from MS 201 via network interface 215. In 
response to this indication, cellular interworking device 216 sends an 
indication to MSG 251 that the MS is on channel (320). Specifically, this 

15 indication is a MAP MSONCH message. 

MSG 251 then switches the MS 201 call information to CAG 214. 
CAG 214 receives the call information (via DSO signaling, e.g.) and 
routes (321) it to MS 201 via IP network 211 and WLAN AP 210. Thus. 
MS 201 completes a handoff from the cellular network to the WLAN, 

20 continuing to receive its call information via M SC 251, CAG 214, and 
WLAN AP 210. 

In the foregoing specification, the present invention has been 
described with reference to specific embodiments. However, one of 
ordinary skill in the art will appreciate that various modifications and 

25 changes may be made without departing from the spirit and scope of the 
present invention as set forth in the appended claims. Accordingly, the 
specification and drawings are to be regarded in an illustrative rather 
than a restrictive sense, and all such modifications are intended to be 
included within the scope of the present invention. In addition, those of 

30 ordinary skill in the art will appreciate that the elements in the drawings 
are illustrated for simplicity and clarity, and have not necessarily been 
drawn to scale. For example, the dimensions of some of the elements 
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in the drawings may be exaggerated relative to other eleoients to help 
improve an understanding of the various embodiments of the present 
invention. 

Benefits, other advantages, and solutions to problems have been 
5 described above with regard to specific embodiments of the present 
invention. However, the benefits, advantages, solutions to problems, 
and any element(s) that may cause or result In such benefits, 
advantages, or solutions, or cause such benefits, advantages, or 
solutions to become more pronounced are not to be construed as a 

10 critical, required, or essential feature or element of any or all the claims. 
As used herein and in. the appended claims, the term "comprises," 
"comprising," or any other variation thereof is intended to refer to a non- 
exclusive Inclusion, such that a process, method, article of manufacture, 
or apparatus that comprises a list of elements does not include only 

15 those elements in the list, but may include other elements not expressly 
listed or Inherent to such process, method, article of manufacture, or 
apparatus. 

The terms a or an, as used herein, are defined as one or more 
than one. The term plurality, as used herein, is defined as two or more 

20 than two. The term another, as used herein, i s d efined a s a 1 1 east a 
second or more. The terms including and/or having, as used herein, are 
defined as comprising (i.e., open language). The term coupled, as used 
herein, is defined as connected, although not necessarily directly, and 
not necessarily mechanically. The term program, as used herein, is 

25 defined as a sequence of instaictions designed for execution on a 
computer system. A program, or computer program, may include a 
subroutine, a function, a procedure, an object method, an object 
implementation, an executable application, an applet, a servlet, a source 
code, an object code, a shared library/dynamic load library and/or other 

30 sequence of instructions designed for execution" on a computer system. 
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Claims 

1. An access gateway able to facilitate handoff from a cellular 
wireless network to a non-cellular wireless network, the access gateway 

5 comprising: 

a network interface; and 

a cellular intenworking device, communicatively coupled to the 
network interface, 

adapted to receive a handin request from a mobile station (MS) 
10 via a non-cellular access point and the network interface, 

adapted to send a handin request acknowledgment to the MS via 
the non-cellular access point and the network interface In response to 
the handin request, 

adapted to receive <a handoff indication from a mobile switching 
15 center (MSG) associated with the MS, 

adapted to receive a handoff complete indication from the MS via 
the non-cellular access point and the network interface, and 

adapted to send an indication to the MSG that the MS is on 
channel, In response to the handoff complete indication. 

20 

2. The access gateway of claim 1 , wherein the cellular interworking 
device is adapted to perfomri cellular mobility interworking by interfacing 
with MSGS and home location registers (HLRs). 

25 3. A method for facilitating handoff of a mobile station (MS) from a 
cellular wireless network to a non-cellular wireless network comprising: 

receiving, by an access gateway, a handin request from the MS 
via a non-cellular access point; 

sending, by the access gateway in response to the handin 
30 request, a handin request acknowledgment to the MS via the non- 
cellular access point; 
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receiving, by the access gateway, a handoff indication from a 
mobile switching center (MSG) associated with the MS; 

receiving, by the access gateway, a handoff complete indication 
from the MS via the non-cellular access point; and 
5 sending, by the access gateway in response to the handoff 

complete indication, an indication that the MS is on channel to the MSG 
associated with the MS. 

4. The method of claim 3, further comprising: 
10 receiving, by the access gateway, call infomiation for the MS from 

the MSG; and 

routing, by the access gateway, the call information to the MS via 
the non-cellular access point. 

1 5 5. The method of claim 3, further comprising sending, by the access 
gateway, a MAP facdir2 message to the MSG in response to the MAP 
FAGDiR2 message. 

6. A mobile station (MS) able to handoff from a cellular wireless 
20 network to a non-cellular wireless network, the MS comprising: 
a transmitter; 
a receiver; and 

a processor, communicatively coupled to the transmitter and 
receiver, 

25 adapted to send, via the transmitter, a handin request to an 

access gateway via a non-cellular access point, 

adapted to receive, via the receiver, a handin request 
acknowledgmentf rem the a ccess g ateway via the non-cellular access 
point, 

30 adapted to send, via the transmitter after receiving the handin 

request acknowledgment, a signal strength message to a serving 
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cellular base site, wherein the signal strength message comprises 
values intended to trigger a handoff determination, 

adapted to receive, via the receiver, a handoff release Indication 
from a serving cellular base site, and 
5 adapted to send, via the transmitter and after receiving the 

handoff release indication, a handoff complete indication to the access 
gateway via the non-cellular access point. 

7. A method for handing off from a cellular wireless network to a 
10 non-cellular wireless network comprising: 

sending, by a mobile station (MS), a handin request to an access 
gateway via a non-cellular access point; 

receiving, by the MS, a handin request acknowledgment from the 
access gateway via the non-ceI!ular access point; 
15 sending, by the MS after receiving the handin request- 

acknowledgment, a signal strength message to a serving cellular base 
site, wherein the signal strength message comprises values intended to 
trigger a handoff determination; 

receiving, by the MS, a handoff release indication from the 
20 serving cellular base site; and 

sending, by the MS after receiving the handoff release indication, 
a handoff complete indication to the access gateway via the non-cellular 
access point. 

25 8. The method of claim 7, wherein the handin request comprises an 
indication of from which cellular wireless network the MS is attempting to 
handoff. 

9. The method of claim 7, wherein the handin request 
30 acknowledgment comprises a handoff-target identifier. 



1 0. The method of claim 7, further comprising: 
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receiving, by the MS, call information via the serving cellular base 
site and a mobile switching center (MSG) associated with the MS; and 

receiving, by the MS, call information via the non-cellular access 
point, the access gateway, and the MSG. 
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Abstract — Low cost, higb speed wireless LAN networks can be 
integrated within the cellular coverage to provide hot spot 
coverage for high speed data services. This article presents a 
novel approach for integrating North American 3G cellular 
network and 802.11 wireless LAN networks. The inter- 
technology mobility is supported using the standard cdnia2000 
functions and signaling. 

Keyfvonb: IEEES0ZJ1, CDMA2000, moNlity, hot spot, 
heterogeitous ttettvorks 

1. Introduction 
The 3G cellular networks are designed to offer high speed 
access for mobile data users. However, the donand for 
bandwidth in the 3G cell is not unifomi throughout the cell. 
Ratho-, it is clustered in hotspot areas such as airports, hotels, 
shopping malls, apartment buildings. Internet cafes etc. In 
addition, the availability of bandwidth in the 3G cell is not 
uniform throughout the cell. In general, higher bandwidths are 
only available close to the cell site while only lower 
bandwidths are available fiirther from the cell site. Fading and 
obstructions fiirther affect the availability of bandwidth at any 
point within the ceU. IEEE 802. 1 1 Wireless LAN (WLAN) is a 
short-radius radio technology that is gaining a tremendous 
momentum in the marketplace. The cellular operator can take 
advantage of this low cost, hi^ speed technology to cover the 
hot spots and gaps in cover^e within its cellul^ network. In 
such scenarios, the mobile wireless access network is expected 
to be heterogeneous in nature and may allow the mobile user to 
move between the 3G cellular to the WLAN coverage area and 
vice versa. However, neitho- the existing 3G cellular nor the 
WLAN standards provide an integrated network architecture to 
support seamless mobility of the user between the two 
technologies. An integrated network architecture to support 3G 
UMTS netvrork and WLAN is presented in [1]. Some otiier 
related work on WLAN inter-operability can be found in (2, 3, 
4]. In this article, we propose a novel architecture to allow 
seamless mobility between the North American 3G cellular 
standard (cdma2000) and 802.11 WLAN networks. This 
proposal reuses the standard cdma2000 fimctions and 
signalling messages to perform an inta--tedmology handover. 



II. Background 
A. CDMA2000 Network 

The 3rd generation North American wireless standard [5] is 
based on cdma2000 radio technology. It provides circuit- 
switched (CS) service for voice and the packet-switched (PS) 
service for data transport. The network between the mobile 
station and the base station controller (BSC) (mcluding the 
base station BTS) forms the radio access part of the cdma2000 
network (Figure 1). The packet network is represented by the 
R-P (radio-to-packet) interfece between BSC and packet data 
serving node (PDSN). The generic encapsulation protocol 
(GRE) [18] is recommended for the R-P interface. A packet 
control fimction (PCF) at the BSC handles the packet 
signaling and data transfer between the radio and packet parts 
of the cdma2000 network. End-to-end packet data between the 
mobile station and the packet data serving node (PDSN) is 
transported through the Point-to-Point Protocol (PPP) [11]. 



To BackboDe Internet 




Figure 1 . An Exait^le of CDMA 2000 Network 



B. 802.11 WLA]^ and IP over WLAN 

The IEEE 802.1 1 WLAN [7, 8, 9] network is composed of 
a number of access points (APs) and the Mobile Stations (MS) 
accessing the WLAN network through one of the APs. A 
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number of APs can be interconnected through an IP routed 
network to form the WLAN IP network. An access router (AR) 
connects one or more APs to the IP access network. An access 
network gateway (ANG) connects the WLAN IP access 
network to die backbone Internet world, as shown in Figure 2. 



To Backbone Internet 




Figure 1 . Ao Exan^le of WLAN IP Network 



A. CDMA2000 and WLAN Integration: HotSpot Scenario 

A hotspot area is defined as a doise population of the uscts 
in a small area. An operator may have cellular coverage across 
these areas but it may want to provide lower cost, W^ct speed 
coverage to the iisers in the hot spot area. In this hot spot 
scenario, WLAN is used primarily for data connection only 
and it operates in conjunction with the cdma2000 cellular 
network. Users with dual-mode mobile devices can access the 
two networks. The devices have two network interfaces - one 
connects with the cellular network and the other wifli WLAN 
network. It is possible to use common billing and netwoik 
authoitication infrastructure as well as commcm connectivity to 
the Internet. 




WLAN hot SDOts 



Figure 2. Hoi Spot Coverage with Inte^ed Cellular and WLAN networks 



m. Integrated Network. ARCHITECTURE 
The Integrated architecture proposes re-using the PDSN of 
cdma2000 network to forward the WLAN traflBc as well. A 
proxy packet control fimction introduced at ANG replicates the 
PCF function of cdma2000 BSC. In this way, it acts as a 
gateway between the WLAN IP network and the PDSN. The 
WLAN access network appears as anoiho- cdnia2000 network 
to the PDSN (refer Figure 4). 

The integrated network architecture re-uses as much as 
possible from the existing cdnaa2000 and 802.11 WLAN 
protocols. Hence, no changes are required to the standard 
cdma2000 PS service or to the standard 802.11 AP. However, 



in orAa to achieve an integrated network operation supporting 
seamless mobility between flie two tedmologies, the following 
new fimctions are introduced. 

• The mobile station must have both, a WLAN and a 
cdma2000 radio inter&ce. It makes intelligait 
decisions on wiiich radio technology to use at any 
moment, and diverts the PPP frames to the selected 
radio interface. 

• A proxy-PCF (p-PCF) function at ANG (in WLAN IP 
network) implements the R-P interface in order to 
communicate to the PDSN. 

• An Access Router (AR) discovers and selects a p-PCF 
in WLAN IP network and timnels PPP frames from the 
MS served by its APs to the p-PCF. 

Note that the cdma2000 standard allows two modes of IP 
access; Simple and Mc>bile IP mode. The Integrated network 
architecture is transparent to the cdma2000 IP access mode and 
works well for both methods. 




Figure 3 . Integrated Network Architecture 

In the following sections, we explain the ways in w^ich 
various access and network operations are supported in the 
integrated network architecture. 

IV. Access authentication 

A. CDMA2000 Network 

Two levels of security are provided in the cdma2000 
network. In the first level of security, the mobile device is 
authenticated and authorized by mobile switching center 
(MSG) through the home location register (HLR) and visitor 
location registo- (VLR) databases. This is performed prior to 
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granting access to the radio network for packet data service. In 
the IP network access security mode, the mobile user is 
auflienticated and authcnized using standard authentication, 
authorization and accounting (AAA) [20] protocol via PDSN. 
This step is performed prior to granting access to the IP 
network. 

B. 802.11 WLAN Network 

The 802. Ix protocol enables access authentication through 
the 802.11 WLAN access network. This protocol allows the 
mobile stations (MS) to be authenticated via the access points 
and vice versa. 802. Ix takes advantage of an existing 
authentication protocol known as the Extensible Authentication 
Protocol (EAP) [17]. The 802. Ix authentication for wireless 
LANs has three main components: The supplicant (usually the 
client-software in the MS); the authenticator (usuaUy the access 
point); and the authentication server (usually a Remote 
Authentication Dial-In User Service server). At tiie end of the 
802. Ix transactions, the goal of authenticating Ihe mobile 
stations by the 802.11 network is completed, enabling the 
access point port for uninhibited access by the end station. 
However, this leaves the access point open to attacks by a 
rogue mobile station that can spoof the identity of the 
authorized station. The Robust Secure Networic Association 
(RSNA) [19] protocol being standardized by IEEE 802.111 
allows for packets between the access point and end station to 
be encrypted and signed. RSNA uses advanced cryptographic 
technologies (TKIP, AES) to provide a higher level of security. 
Once the RSNA exchange has been completed, the end station 
and the access iwint have shared secret keys that can be used to 
encrypt and sign subsequent packets. This allows the access 
point to indeed ensure that only the authenticated user is using 
the ports. 

V. IP Address Management 
The cdma2000 and the WLAN networks may use subnet IP 
domains that are topologically distinct. At the PDSN, the 
routing of the IP traffic to/from the MS is performed based on 
the IP address assigned to the MS by the PDSN during the 
PPP/IPCP negotiation phase. This address may not be 
topologically correct when the MS is attached to the WLAN 
network which may cause the forwarding of IP packets to/from 
the MS to fail. 

The integrated ardvitecture assigns a separate IP transport 
address to the MS that is used within the WLAN network to 
route the packets to the AR that is currently serving the MS. 
This address must be assigned only once v^en the MS first 
gets attached to the WLAN network and is not changed as long 
as the MS is moving within WLAN access network. The AR to 
which the MS first gets attached in the WLAN network 
provides or requests this IP address on behalf of the MN — this 
address is not visible to the MS itself. The micro-mobiUty 
solution used within the WLAN is transparent to the MS and 
uses this IP transport address to forward packets to/from MS 
within WLAN network. 



VI. MOBIUTV 

A. Mobility across cdma2000 Technology 

Three levels of mobility support are provided in the 
cdma2000 architecture: 

The first level of mobility is at the sector/sector or cell/cell 
level [5] within the domain of a PCF. This level of mobility is 
handled at the radio link layer and is hidden from the PDSN 
and from higher level mobility fimctions (e.g. Mobile IP 
foreign agent (FA) and home agent (HA)). 

The second level of mobility is across PCF domains within 
the scope of a PDSN. This is handled by the PDSN because it 
can be logically connected to more than raie PCF. This level of 
mobility is referred to as "R-P Mobility" or "intra-PDSN 
Mobility". The R-P inter&ce for a sessim can be moved from 
one PCF to the other in sudi a way that it is transparent to the 
PPP session nmning between the MS and the PDSN. Because 
the PPP session remains on the same PDSN, that session is 
kept intact and the MS does not need to renegotiate PPP, LCP 
or rPCP options. 

The highest level of mobility in cdma2000 is available only 
when the PDSN incorporates a Mobile IP Foreign Agent (FA) 
whidi allows mobility with respect to the connection point to 
the Internet to be anchored at the Home Agent (HA). This level 
of mobility is described as "Macro-Mobility" and allows inter- 
PDSN mobility to occur. If the mobility handoff results in an 
connection to a new PCF that does not have access to the old 
PDSN/FA (intCT-PDSN mobihty), a new PPP session must be 
established. When using Mobile IP, the PDSN/FA is informed 
that a new PPP session is active and the PDSN/FA issues an 
Agent Advertisement on that session. The mobile responds 
with a Registration Request which the PDSN/FA forwards to 
the HA. 

B. Mobility Support across WLAN Technology 

The hiter Access Point Protocol (lAPP) [10] controls the 
mobility across APs connected through the same AR (an intra- 
AR handover). 

An inter- AR handover, using IP-based micro-mobility 
meciianisms, is required w*en die APs involved in the 
handover are ccnmected to different ARs. The mobile does not 
change its IP address during the course of its association and 
de-assocnation with different APs. There are currently no 
standards in this area, however thwe are a numbo" of proposed 
protocols that attempt to solve llie local mobility of mobile [12, 
13, 14, 15, 16]; the mechanism described earlier under "IP 
Address Managemenf ' is another one of these approaches. 

C. Inter-Technology Handover ynth 'PCF-Peering' 

The point-to-point protocol (PPP) is the standard 
mechanism for packet data transport in a cdma2000 network. 
In crder to perform a seamless handoff of the cdma2000 data 
session, the PPP state must be kept up and running at the two 
PPP endpoints (MS and the PDSN) before, during and after the 
handoff. If the PPP session is broken, it takes a minimum of 9 
and a maximum of 15 messages between the MS and the 
PDSN to (re-) negotiate a PPP session. This includes the link 
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layer, authoitication, and network layer negotiation phases, all 
of whicb must be re-done if the PPP session is broken; it does 
not include possible additional messages due to dropped or 
damaged packets over the air. 

As mentioned in previous sections, R-P mobility (Intra- 
PDSN, Inter-PCF handover) mechanism of the CDMA2000 
standard supports the mobility between the PCFs without 
breaking the PPP session between the MS and the PDSN. The 
handoff between the two PCFs is performed as a layer 2 
handoff while the upper layer states (like the PPP state) remain 
undianged. We propose a "PCF-Pea-ing" mechanism that re- 
uses the concq>t of inta--PCT, intra-PDSN (R-P mobility) to 
perform the seamless mobility between odma2000/ WLAN 
technologies. The "proxy-PCF" fimctionality is introduced in 
the WLAN access network gateway (ANG) which connects the 
WLAN access network with the cdnia2000 PDSN. The WLAN 
access network is hidden behind this Proxy PCF and appears as 
a cdma2000 radio access network to the PDSN. The PPP data 
is transported through tiie GRE-based interfece between the 
proxy PCF and the PDSN while the data transport between the 
proxy PCF and the AP still uses the inhmted micro mobility 
and link layer mechanisms of die wireless technology to set up 
the data transport. Figure 4 presents the network architecture 
for the integrated cdma2O0O-WLAN access network witii PCF- 
Peering concept 

1) General Scenarios 
Following are the four main scenarios that can be discussed to 
explain the integrated architecture: 

a) MS powers up in cdma2000 network and establishes PPP 
session with PDSN 

b) MS handovers from the WLAN access to cdma2000 
access with pre-established PPP state 

c) MS powers up in WLAN access networks and establishes 
PPP state with PDSN 

d) MS handovers from the cdma2000 access network with 
pre-established PPP state 



Scenarios (a) and (b) follow the standard cdma2000 
procedures described in [6] and are not described further in this 
document The following sections capture scenario (c), the 
power up in 802.11 WLAN access network, and scenario (d), 
handover from cdma2000 access network to 802.11 access 
network. Figures 5 and 6 describe the high level interactions 
between various network elements for power up and handover, 
scenarios (c) and (d) respectively, hi both cases, the 
communicatioQ between the ANG (vtliere p-PCF fimction 
resides) and the PDSN follows the cdma2000 standard All 
signalling procedures [6]. 

2) MS Powers up in WLAN 
In scenario (c), during power up in WLAN access network, 
MS uses the IP address assigned to the MS by the PDSN 
during the PPP establishment phase to communicate with the 
AR. However, the routing of IP trafiBc between the AR and 
ANG is performed using the WLAN transport address assigned 
to the MS by the AR during the association phase. 




Figure 4 . MS Power up in WLAN Procedures 

3) Cdma2000 to WLAN Handoff 
In scenario (d), w^en the WLAN air interface of the MS 
1 sb-ong WLAN coverage while having pre-established 
data sessions (and hence the PPP state at the PDSN) via 
cdma2000 access network, it re-uses the PDSN assigned IP 
address w4ien it attaches to the WLAN network An inter-PCF 
handover is performed (between the PCF at cxhna2000 BSC 
and the p-PCF at the WLAN ANG) and the MS continues 
sending/receiving IP traffic via flie WLAN access network No 
PPP (re-)establi^iment is required in this scenario. Once again, 
the routing of IP traEEic between tiie AR and ANG is performed 
using the WLAN transport address assigned to the MS by the 
AR during the association phase. 




Figures. CDMA2000-to-WLAN Handoff Procedures 



vn. Packet Transport 
The packet transport in the integrated network uses PPP 
framing between the MS and the PDSN as defined by the 
cdma2000 standard. 

However, flie following modes of packet transport are used 
across WLAN network. 
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• Layer 2 end points of the data transport are the MS and 
the AR. The data transport medianism uses raw 
encapsulation of PPP packets inside 802. 11 /Ethernet 
frames ' . The MS transmits/receives the PPP data 
encapsulated in 802.1 1 frames to/from the AP. The AR 
transmits/receives the PPP data encapsulated in 
Ethernet frames. 

• Tunneled (PPP-in-IP) transport of the PPP data is used 
between AR and the ANG/Proxy-PCF. 

• Tunneled (PPP-in-GRE) transport of the PPP data is 
used over the R-P interfece. 




802.11 



Figure 6. Bearer plane protocol slacks 

vm. Accounting 
Since the PCF-peering mechanism re-uses the R-P mobility 
concept, the proposed architecture does not require any special 
mechanism to enable the accounting/charging during handoffs 
between the cdma2000 and WLAN access networks. The 
current standard supports mechanisms to inform the AAA 
server when an R-P inter&ce is moved. 

IX. Conclusion 
In this paper, we presented the unique concept of "PCF- 
peering" that can be applied to perform seamless handoffs 
between the 3G cdma2000 and WLAN access technologies. 
The paper explains the proposed network architecture and the 
functions that are required at various network elements. The 
main advantage of the PCF-peering concept is that it uses the 
existing cdma2000 mobility management mechanisms to 
handle the handoffe between cellular and WLAN access 
technologies. The handoff is performed at layer 2 so that the 
upper layers are not even aware of the change of radio 
inter&oe. This concept does not require any changes to the 
existing cdma2000 radio/network standards nor to the WLAN 



' PPP encapsulation over Ethernet is different from PPPoE 
and is not a standard mechanism as yet 



radio standard, allowing it to be introduced into existing 
cdma2000 and 802.1 1 networks. 
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